Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

a few users have logged into a server through RDP.

I would like to monitor activity, but do not know my way round Windows Server that well.

I am hoping there are logs of some kind around that I can consult.

Any ideas? :)

share|improve this question

migrated from Nov 25 '10 at 17:13

This question came from our site for professional and enthusiast programmers.

up vote 3 down vote accepted

A few options..

  1. Basic windows logging using the policy setting "Audit Logon Events" should cover your needs.
  2. You can also use a Remote Desktop Gateway and configure auditing that logs which users are accessing which internal resources via RDP. Some additional information is available here.
  3. SecureRDP has detailed logging that outputs to .CSV format. SecureRDP is now offered for free.
share|improve this answer
  1. Open Event Viewer (eventvwr.msc)
  2. Go to to Applications and Services Logs -> Microsoft -> Windows -> TerminalServices-LocalSessionManager
  3. Open Admin or Operational

You will see the sessions list. Date/Timestamped/IP/UserName etc. You can also look under Applications and Services Logs\Microsoft\Windows\TerminalServices-RemoteConnectionManager

share|improve this answer
The client IP (Source Network Address) is blank for me on Windows Server 2012. How do you enable it? – Sacha K Feb 12 '15 at 13:09
I wrote up a tool that parses the Event viewer for you and shows you a history of logins. You can grab the tool from my blog:… – KPS Oct 21 '15 at 20:31

Other than combing through the event logs, looking for Logon Type 10 (Remote Desktop) in the Security Log, or looking at the TerminalServices channel event logs, you'll need to use third party software.

In addition to TSL mentioned above, here is one other I've used with success in the past - Remote Desktop Reporter

If you go third party, make sure you evaluate several and get price quotes from each vendor ... there is a huge discrepancy in price - some vendors price per named user, some per concurrent user, and some simply by server. Make sure also that the solution comes with its own database or a lite version of SQL - otherwise you'll get hit with database license costs as well.

share|improve this answer

Disclaimer: I work for Acceleratio.

You can use Terminal Services Log to track user activity on the server for everybody who connected through the RDP protocol.

You can check out user activity at: SysKit User Activities

share|improve this answer

You can have a look here. It's for Windows XP but most of it is still valid.

share|improve this answer

You can set any user account in AD for remote control to view or interact with a user's session by going to the Users tab in Task Manager, right clicking and select 'Remote Control'. You can then view their session.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.